<?xml version="1.0" encoding="ISO-8859-1"?>
<rss version="2.0">
<channel>
<title>BugHunter.net - Security docs, tutorials and whitepapers</title>
<description>This RSS feed lists the latest security papers added on BugHunter Security Docs ( http://doc.bughunter.net/ ). These articles talk about buffer overflows, format strings vulnerabilities, rootkits, network security, and a lot of other security topics.</description>
<link>http://doc.bughunter.net/</link>
<lastBuildDate>Mon, 07 Jul 2008 00:44:03 +0200</lastBuildDate>
<generator>http://doc.bughunter.net/</generator>
<language>en-US</language>
<copyright>http://doc.bughunter.net/</copyright>
<ttl>60</ttl>
<item>
<title><![CDATA[Port Scanning Unscanned]]></title>
<link>http://doc.bughunter.net/network-security/portscan.html</link>
<guid isPermaLink="true">http://doc.bughunter.net/network-security/portscan.html</guid>
<description><![CDATA[Port Scanning is one of the most commonly carried out process amongst Hackers. This text written by Ankit Fadia explains how a port scanner can deduce whether a particular port on a remote system is closed or open. This paper describes the most commonly used port scanning techniques (tcp connect, SYN scan, FIN scan, Xmas/Null scan, UDP port scan).]]></description>
<pubdate>Sun, 29 Jan 2006 14:34:05 +0100</pubdate>
</item>
<item>
<title><![CDATA[Bruteforcing format strings]]></title>
<link>http://doc.bughunter.net/format-string/bruteforce.html</link>
<guid isPermaLink="true">http://doc.bughunter.net/format-string/bruteforce.html</guid>
<description><![CDATA[This text written by gera is about two tiny tricks that may help speeding up bruteforcing when exploiting format strings bugs.]]></description>
<pubdate>Sun, 08 Jan 2006 17:48:45 +0100</pubdate>
</item>
<item>
<title><![CDATA[Buffer overflows demystified]]></title>
<link>http://doc.bughunter.net/buffer-overflow/buffer-overflows.html</link>
<guid isPermaLink="true">http://doc.bughunter.net/buffer-overflow/buffer-overflows.html</guid>
<description><![CDATA[This paper written by Murat explains what are the vulnerabilities called "buffer overflows" and documents the way to write exploits making use of such coding flaws.]]></description>
<pubdate>Sun, 01 Jan 2006 22:08:44 +0100</pubdate>
</item>
<item>
<title><![CDATA[Smashing The Stack For Fun And Profit]]></title>
<link>http://doc.bughunter.net/buffer-overflow/smash-stack.html</link>
<guid isPermaLink="true">http://doc.bughunter.net/buffer-overflow/smash-stack.html</guid>
<description><![CDATA[On many C implementations it is possible to corrupt the execution stack by writing past the end of an array declared auto in a routine. Code that does this is said to smash the stack, and can cause return from the routine to jump to a random address, in order to execute arbitrary code. This paper written by Aleph One explains how to exploit these vulnerabilities.]]></description>
<pubdate>Tue, 27 Dec 2005 23:26:28 +0100</pubdate>
</item>
<item>
<title><![CDATA[Advanced Doug lea's malloc exploits]]></title>
<link>http://doc.bughunter.net/buffer-overflow/advanced-malloc-exploits.html</link>
<guid isPermaLink="true">http://doc.bughunter.net/buffer-overflow/advanced-malloc-exploits.html</guid>
<description><![CDATA[This paper written by jp details several advanced techniques that allow a more generic and reliable exploitation of malloc corruption, allowing an attacker to overwrite an arbitrary 4 byte value anywhere in the process memory.]]></description>
<pubdate>Tue, 27 Dec 2005 23:25:17 +0100</pubdate>
</item>
<item>
<title><![CDATA[Taking advantage of non-terminated adjacent memory spaces]]></title>
<link>http://doc.bughunter.net/buffer-overflow/exploit-strncpy.html</link>
<guid isPermaLink="true">http://doc.bughunter.net/buffer-overflow/exploit-strncpy.html</guid>
<description><![CDATA[This article details the hazards of non-terminated buffers (specifically non-terminated strings), and their potential impact on the security of a application. This issue is discussed from a variety potential situations, culminating with an example exploit which abuses adjacent non-terminated string buffers together to perform program redirection via a buffer overflow.]]></description>
<pubdate>Tue, 27 Dec 2005 23:23:31 +0100</pubdate>
</item>
<item>
<title><![CDATA[Smashing The Heap For Fun And Profit]]></title>
<link>http://doc.bughunter.net/buffer-overflow/heap-corruption.html</link>
<guid isPermaLink="true">http://doc.bughunter.net/buffer-overflow/heap-corruption.html</guid>
<description><![CDATA[This paper written by MaXX could be entitled "Smashing The Heap For Fun And Profit". Indeed, the memory allocator used by the GNU C Library (Doug Lea's Malloc) and the associated heap corruption techniques are presented. It is one of the most complete article about heap corruption.]]></description>
<pubdate>Tue, 27 Dec 2005 23:22:59 +0100</pubdate>
</item>
<item>
<title><![CDATA[Stack Exploit Coding - A PERL perspective]]></title>
<link>http://doc.bughunter.net/buffer-overflow/perl-exploit.html</link>
<guid isPermaLink="true">http://doc.bughunter.net/buffer-overflow/perl-exploit.html</guid>
<description><![CDATA[PERL stack buffer overflow exploits aren't as well explored as C exploits when it comes to munging the stack. This brief paper written by Dethy will outline ways PERL can be used to create a working exploit with greater ease than standard C based exploits.]]></description>
<pubdate>Tue, 27 Dec 2005 23:22:59 +0100</pubdate>
</item>
<item>
<title><![CDATA[Buffer Overruns]]></title>
<link>http://doc.bughunter.net/buffer-overflow/buffer-overrun.html</link>
<guid isPermaLink="true">http://doc.bughunter.net/buffer-overflow/buffer-overrun.html</guid>
<description><![CDATA[A buffer overrun is writting to more memory than was reserved. Since this often happens on the stack, an understanding of how the stack works is essential. This paper written by Lefty presents how the stack is implemented on linux, and how to exploit buffer overrun flaws.]]></description>
<pubdate>Tue, 27 Dec 2005 23:22:57 +0100</pubdate>
</item>
<item>
<title><![CDATA[The Frame Pointer Overwrite]]></title>
<link>http://doc.bughunter.net/buffer-overflow/frame-pointer.html</link>
<guid isPermaLink="true">http://doc.bughunter.net/buffer-overflow/frame-pointer.html</guid>
<description><![CDATA[This article written by klog demonstrates it is possible to exploit stack overflows even under the worst conditions. Many esoteric techniques where the goal is to exploit trusted processes in the most hostile situations exist, including when privileges are dropped. This paper covers the one-byte overflow case.]]></description>
<pubdate>Tue, 27 Dec 2005 23:22:20 +0100</pubdate>
</item>
<item>
<title><![CDATA[The story of exploiting kmalloc() overflows]]></title>
<link>http://doc.bughunter.net/buffer-overflow/kmalloc-overflow.html</link>
<guid isPermaLink="true">http://doc.bughunter.net/buffer-overflow/kmalloc-overflow.html</guid>
<description><![CDATA[Recently, many kernel level heap (kmalloc) overflows have been discovered which were rated "unclear" with regard to exploitation. This article written by qobaiashi aims at explaining the kernels heap management, with security and exploitation of heap overflows in kernel space in mind.]]></description>
<pubdate>Tue, 27 Dec 2005 23:21:28 +0100</pubdate>
</item>
<item>
<title><![CDATA[Once upon a free()]]></title>
<link>http://doc.bughunter.net/buffer-overflow/free.html</link>
<guid isPermaLink="true">http://doc.bughunter.net/buffer-overflow/free.html</guid>
<description><![CDATA[This paper presents a way to exploit free() corruption and explains how the System V and GNU malloc() are implemented.]]></description>
<pubdate>Tue, 27 Dec 2005 23:20:47 +0100</pubdate>
</item>
<item>
<title><![CDATA[Smashing C++ VPTRS]]></title>
<link>http://doc.bughunter.net/buffer-overflow/cpp-vptrs.html</link>
<guid isPermaLink="true">http://doc.bughunter.net/buffer-overflow/cpp-vptrs.html</guid>
<description><![CDATA[For the most part, the techniques that are applicable in C are also available in C++, however, C++ offers new possibilities in regards to buffer overflows, mostly due to the use of object oriented technologies. This paper written by rix analyze one of these possibilities, using the C++ GNU compiler, on an x86 Linux system.]]></description>
<pubdate>Tue, 27 Dec 2005 23:19:52 +0100</pubdate>
</item>
<item>
<title><![CDATA[w00w00 on Heap Overflow]]></title>
<link>http://doc.bughunter.net/buffer-overflow/w00w00-heap.html</link>
<guid isPermaLink="true">http://doc.bughunter.net/buffer-overflow/w00w00-heap.html</guid>
<description><![CDATA[This article written by w00w00 provides a better understanding of heap-based overflows along with several methods of exploitation, demonstrations, and some possible solutions/fixes.]]></description>
<pubdate>Tue, 27 Dec 2005 23:18:53 +0100</pubdate>
</item>
<item>
<title><![CDATA[Overwriting the .dtors section]]></title>
<link>http://doc.bughunter.net/buffer-overflow/dtors.html</link>
<guid isPermaLink="true">http://doc.bughunter.net/buffer-overflow/dtors.html</guid>
<description><![CDATA[This paper presents a concise explanation of a technique to gain control of a C program's flow of execution given that it has been compiled with gcc. This text written by Juan M. Bello Rivas assumes that the reader is familiar with general overflow techniques and the ELF format.]]></description>
<pubdate>Tue, 27 Dec 2005 23:18:00 +0100</pubdate>
</item>
<item>
<title><![CDATA[Memory bugs: atexit]]></title>
<link>http://doc.bughunter.net/buffer-overflow/atexit.html</link>
<guid isPermaLink="true">http://doc.bughunter.net/buffer-overflow/atexit.html</guid>
<description><![CDATA[This is short paper written by Pascal Bouchareine shows a way to execute arbitrary instructions using atexit().]]></description>
<pubdate>Tue, 27 Dec 2005 23:17:18 +0100</pubdate>
</item>
<item>
<title><![CDATA[Smashing The Kernel Stack]]></title>
<link>http://doc.bughunter.net/buffer-overflow/kernel-stack.html</link>
<guid isPermaLink="true">http://doc.bughunter.net/buffer-overflow/kernel-stack.html</guid>
<description><![CDATA[This article written by Sinan "noir" Eren is about recent exposures of many kernel level vulnerabilities and advances in their exploitation which leads to trusted (oops safe) and robust exploits. It focuses on 2 recent vulnerabilities in the OpenBSD kernel. The goal of this paper is to explore and demonstrate generic ways to exploit stack overflows and signed/unsigned vulnerabilities in kernel space.]]></description>
<pubdate>Tue, 27 Dec 2005 23:16:29 +0100</pubdate>
</item>
<item>
<title><![CDATA[Off by One Information Leak - Address Relay Fingerprinting]]></title>
<link>http://doc.bughunter.net/buffer-overflow/offbyone-infoleak.html</link>
<guid isPermaLink="true">http://doc.bughunter.net/buffer-overflow/offbyone-infoleak.html</guid>
<description><![CDATA[This paper written by vade79/v9 discusses how to use values returned from programs to create fingerprints. Most of the information contained in this paper will relate to off-by-one buffer miscalculations. While they are very common, not all are exploitable, and often get dismissed due to that. As these bugs may not always yield exploitable conditions, they do tend to relay and leak informations about the victim machine.]]></description>
<pubdate>Tue, 27 Dec 2005 23:11:58 +0100</pubdate>
</item>
<item>
<title><![CDATA[How to code stack based exploits]]></title>
<link>http://doc.bughunter.net/buffer-overflow/code-stack-exploits.html</link>
<guid isPermaLink="true">http://doc.bughunter.net/buffer-overflow/code-stack-exploits.html</guid>
<description><![CDATA[Buffer overflows are the result of stuffing more data into a buffer than it can handle. Upon writing past the buffer, the program will often lead to unknown results, even the potential to execute arbitary code, if a certain memory pointer is overwritten. This short paper written by Dethy presents how to exploit them.]]></description>
<pubdate>Tue, 27 Dec 2005 23:00:52 +0100</pubdate>
</item>
<item>
<title><![CDATA[Exploiting Format String Vulnerabilities]]></title>
<link>http://doc.bughunter.net/format-string/exploit-fs.html</link>
<guid isPermaLink="true">http://doc.bughunter.net/format-string/exploit-fs.html</guid>
<description><![CDATA[This paper written by scut explains the nature of format string vulnerabilities. It describes how to find vulnerable C source code, and why format string vulnerabilities are more dangerous than common buffer overflows. Several exploitation techniques are detailled. After reading this article, the reader should be able to exploit almost any kind of format string vulnerability.]]></description>
<pubdate>Tue, 27 Dec 2005 22:57:28 +0100</pubdate>
</item>
</channel>
</rss>
